SEC Begins Cyber Sweep of Investment Advisers with Focus on Cloud Storage

A sweep of investment advisers is underway by the U.S. Securities and Exchange Commission, which has sent out many letters to firms over the last week requesting information about their use of cloud providers.

The move could be part of the SEC’s Phase 3 Cybersecurity Exam Initiative, and is likely related to the April Regulation S-P Risk Alert about how firms are protecting personally identifiable information (PII) they store on cloud provider systems. Relatedly, the SEC may be interested in collecting information on whether firms are disclosing cloud vendors on Form ADV Schedule D, Item 1.L.

Many filers do not disclose cloud vendors on Form ADV, since the question asks for the location of books and records other than your office or principal place of business, and technically, records on cloud systems are accessible from a registrant’s office through a web browser. The Omgeo No-Action Letter from August 2009 permits advisers to store records in the cloud as long as the adviser can access those records from their office. Typically, we see firms disclose on the ADV the location of hard copy records, CDs, etc., at Iron Mountain or other physical storage vendors, as well as the locations of any alternate office locations at which original records are kept. Some firms do disclose cloud providers such as Global Relay, Smarsh and Mimecast, etc. although most don’t. SEC staff stated at a recent conference that it has observed an increased use of cloud providers by registrants.

Firms are using so many cloud vendors from portfolio management systems to Office365 to Dropbox to CSS’ own Ascendant Compliance Manager that the list in Section 1.L would likely be dozens of entries if every firm disclosed every location of electronic records. The SEC is interested in learning whether advisers have a handle on all the locations they are storing PII and other sensitive data. And in a new OCIE Risk Alert released May 23, 2019, “Safeguarding Customer Records and Information in Network Storage,” it is clear that the SEC is also focusing on whether advisers and broker-dealers have properly configured data storage solutions to use available security features to safeguard against unauthorized access. Maintaining a current data inventory of the locations of PII and which data is stored where, as well as conducting adequate oversight of these third party cloud providers, are essential components of a reasonably designed cybersecurity program.


CSS is currently running a “Getting Practical with Cyber” series of webinars. Our next, “In the Driver’s Seat: Your Critical Role in Cyber Resiliency,” takes place on June 11 at 2 pm ET. Register by clicking here.

For more information on how CSS can help you evaluate your cybersecurity program, visit our Shield page.


Subscribe to CSS Blog

CSS frequently publishes blog posts which are written by our team from their observations in the field, at conferences and through experiences with compliance professionals. These posts are designed to further knowledge and share industry best practices. Topics run the gamut, including Form ADV, cybersecurity, MiFID II, position limit monitoring, technology challenges and more. Complete and submit the brief form below to receive notifications when we publish new content.

Latest Content

BME Partners with CSS to Strengthen its Regulatory Service Suite

BME to offer financial services firms in Spain and Portugal a multi-regulation reporting platform Partnership brings a unique combination of local market presence and global coverage BME has partnered with Compliance Solutions Strategies (CSS), a leading RegTech platform provider, to offer a global regulatory reporting solution in Spain and Portugal. The combination of BME’s local … Continued

Compliance Solutions Strategies Acquires AMFINE

Combination Creates First Fully End-To-End Compliance Reporting Platform NEW YORK, September 10, 2020 – Compliance Solutions Strategies (“CSS”), a leading RegTech platform providing technology-driven solutions which enable financial services firms to meet mandatory regulatory compliance requirements, today announced the acquisition of AMFINE (“AMFINE”), a provider of SaaS-based regulatory reporting services to European asset managers, asset … Continued

Compliance Culture in a Bottle

What makes one firm – and the various professionals who represent it – live and breathe by the book, while others are a bunch of scofflaws? I can tell you this for sure: there is no magic potion that you can buy to embed a culture of compliance in an organization. As cliché as it … Continued